What to do when your blog gets injected with a malicious script, worm and infects WordPress

How I compromized my Blog’s security (running on WP 2.9)

Last night, while surfing the web I came across a blog which showed me a blank screen. I tried a few links from the cached copy of the blog but it returned a PHP syntax error. The blog was known to me and I thought the server might be down. After spending some time at other sites, I opened up FileZilla for some FTP access to my blog and after I was done, terminate the connection and went to sleep.

The Symptoms

Today morning, when I opened my blog : Programming Kid, I found some unexpected syntax errors which resembled PHP script gone wrong. I wondered what it was about and restored the said files using WP 2.9 setup from Codex.

The syntax errors went away but there were 500 – Internal Server errors all over my blog. I promptly asked my blogger friends for help on Twitter and help started pouring in. Then Shodan Nayak and Sandeep suggested me to check my blog for some malicious code. I contacted support at my Web Host, HostGator and using the 24X7 live support requested them to have a look into the problem

The Cause

After some help from Shodan and the with the efforts of the brilliant support team at HostGator it was confirmed that my blog running WordPress 2.9 latest version was infected with a botnet called Gumblar which had injected the following code which looked really very suspicious :

Host Gator Support Confirmed it with the following excerpts from the transcript :

“Yeah it definitely seems like something injected some code somewhere into a header and is trying to load html before the php loads, I am not sure how the code was injected, or where the flaw is, but it seems like to me something did compromise your wp somehow.”

So, after the news was confirmed I created a ticket with HostGator and they cleaned my blog within minutes.

What the Investigation revealed

I changed all my passwords as HostGator told me that it happened because the FTP password was compromised. I never keep my password in writing but then I remembered how the attack might have taken place. The blog that I opened the other night might have infected the temporary internet files from Firefox and then the malicious script would have reached my Web Host through the FTP connection I made through FileZilla.

How YOU should keep yourself protected

The following tips were provided by HostGator :

1. Update all scripts and plugins on your account in order to patch any vulnerabilities that may be present.
2. Scan your local computer and any computer from which you have accessed the account using an up to date virus scanner such as http://malwarebytes.org and http://combofix.org/ (Running both is best)
3. Update your cPanel/FTP password with a password that is not easily guessable. Update all passwords that may have been obtained. Do not use old passwords, generate new ones.
4. Submit your site for a scan using your Google Webmaster account. If you do not already have an account please follow the instructions on this page to obtain one: http://www.google.com/support/webmasters/bin/answer.py?answer=45432

You can also use some online free scanners like :

http://housecall.trendmicro.com/

http://www.bitdefender.com/scan8/ie.html

http://www.kaspersky.com/virusscanner

http://support.f-secure.com/enu/home/ols.shtml

Special Thanks

Now that my blog is working fine and I have learnt my lesson the hard-way, I’ll always use Secure FTP using SSL and will not even store the password in the FTP Client.

I would like to thank all my blogger friends on twitter who helped me immensely with their valuable and timely support. Here it goes :

@blogsdna @idavinder @richiesajan @techim @ali360 @rajupp @Bugs5382 @SahilKotak @denharsh @tothepc @IndrekSaarnak @whoisvaibhav

And a special mention to Ash Nallawalla.

Now time for some selfless – self promotion

Thanks to ME who remained calm and pulled of this crisis like situation wonderfully well! I RULE!!!! <evil laugh>

Tagged as: Blogging, Protect WordPress, Secure WordpPress, Wordpress